CVE-2026-13149
High
Description
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.
SeverityHigh
CVSS7.7
Exploit probability—
ProductBrace-expansion
PublishedJun 30, 2026
First seenJun 30, 2026
How to fix
Update
- brace-expansion5.0.7, 1.1.16, 2.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| brace-expansionnpm | 3.0.0 ≤ v < 5.0.7, v < 1.1.16, 2.0.0 ≤ v < 2.1.2 | 5.0.7, 1.1.16, 2.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.